1 # audit_record_attr.txt
2 # Two "#" are comments that are copied to audit_record_attr
3 # other comments are removed.
4 ##
5 ## Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
6 ## Copyright 2019 Joyent, Inc.
7 ##
8 ## CDDL HEADER START
9 ##
10 ## The contents of this file are subject to the terms of the
11 ## Common Development and Distribution License (the "License").
12 ## You may not use this file except in compliance with the License.
13 ##
14 ## You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
15 ## or http://www.opensolaris.org/os/licensing.
16 ## See the License for the specific language governing permissions
17 ## and limitations under the License.
18 ##
19 ## When distributing Covered Code, include this CDDL HEADER in each
20 ## file and include the License file at usr/src/OPENSOLARIS.LICENSE.
21 ## If applicable, add the following below this CDDL HEADER, with the
22 ## fields enclosed by brackets "[]" replaced with your own identifying
23 ## information: Portions Copyright [yyyy] [name of copyright owner]
24 ##
25 ## CDDL HEADER END
1468 comment=3, flags, "flags"
1469
1470 label=AUE_RENAME
1471 format=path1:[attr]1:[path]2
1472 comment=from name:
1473 comment=to name
1474
1475 label=AUE_RENAMEAT
1476 # obsolete
1477 format=path1:[attr]1:[path]2
1478 comment=from name:
1479 comment=to name
1480
1481 label=AUE_RFSSYS
1482 skip=Not used.
1483 # apparently replaced
1484
1485 label=AUE_RMDIR
1486 format=path:[attr]
1487
1488 label=AUE_SEMCTL
1489 format=arg1:[ipc]:[ipc_perm]
1490 comment=1, semaphore ID, "sem ID"
1491 note=ipc_perm
1492 # ipc, ipc_perm token: semctl -> ipc_lookup -> audit_ipc
1493
1494 label=AUE_SEMCTL_GETALL
1495 format=arg1:[ipc]:[ipc_perm]
1496 comment=1, semaphore ID, "sem ID"
1497 note=ipc_perm
1498 syscall=semctl: GETALL
1499 # ipc, ipc_perm token: semctl -> ipc_lookup -> audit_ipc
1500
1501 label=AUE_SEMCTL_GETNCNT
1502 format=arg1:[ipc]:[ipc_perm]
1503 comment=1, semaphore ID, "sem ID"
1504 note=ipc_perm
1505 syscall=semctl: GETNCNT
1506 # ipc, ipc_perm token: semctl -> ipc_lookup -> audit_ipc
1507
|
1 # audit_record_attr.txt
2 # Two "#" are comments that are copied to audit_record_attr
3 # other comments are removed.
4 ##
5 ## Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
6 ## Copyright 2018 Nexenta Systems, Inc. All rights reserved.
7 ## Copyright 2019 Joyent, Inc.
8 ##
9 ## CDDL HEADER START
10 ##
11 ## The contents of this file are subject to the terms of the
12 ## Common Development and Distribution License (the "License").
13 ## You may not use this file except in compliance with the License.
14 ##
15 ## You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
16 ## or http://www.opensolaris.org/os/licensing.
17 ## See the License for the specific language governing permissions
18 ## and limitations under the License.
19 ##
20 ## When distributing Covered Code, include this CDDL HEADER in each
21 ## file and include the License file at usr/src/OPENSOLARIS.LICENSE.
22 ## If applicable, add the following below this CDDL HEADER, with the
23 ## fields enclosed by brackets "[]" replaced with your own identifying
24 ## information: Portions Copyright [yyyy] [name of copyright owner]
25 ##
26 ## CDDL HEADER END
1469 comment=3, flags, "flags"
1470
1471 label=AUE_RENAME
1472 format=path1:[attr]1:[path]2
1473 comment=from name:
1474 comment=to name
1475
1476 label=AUE_RENAMEAT
1477 # obsolete
1478 format=path1:[attr]1:[path]2
1479 comment=from name:
1480 comment=to name
1481
1482 label=AUE_RFSSYS
1483 skip=Not used.
1484 # apparently replaced
1485
1486 label=AUE_RMDIR
1487 format=path:[attr]
1488
1489 label=AUE_SACL
1490 title=File Access Audit
1491 syscall=none
1492 see=none
1493 format=head:path:arg1:[text]2:subj
1494 comment="access_mask":
1495 comment="Windows SID"
1496
1497 label=AUE_SEMCTL
1498 format=arg1:[ipc]:[ipc_perm]
1499 comment=1, semaphore ID, "sem ID"
1500 note=ipc_perm
1501 # ipc, ipc_perm token: semctl -> ipc_lookup -> audit_ipc
1502
1503 label=AUE_SEMCTL_GETALL
1504 format=arg1:[ipc]:[ipc_perm]
1505 comment=1, semaphore ID, "sem ID"
1506 note=ipc_perm
1507 syscall=semctl: GETALL
1508 # ipc, ipc_perm token: semctl -> ipc_lookup -> audit_ipc
1509
1510 label=AUE_SEMCTL_GETNCNT
1511 format=arg1:[ipc]:[ipc_perm]
1512 comment=1, semaphore ID, "sem ID"
1513 note=ipc_perm
1514 syscall=semctl: GETNCNT
1515 # ipc, ipc_perm token: semctl -> ipc_lookup -> audit_ipc
1516
|